Best practices

FortiGate HA is designed to eliminate single points of failure in your network security infrastructure. By clustering devices using the FGCP, you ensure enhanced reliability through seamless failover and can achieve increased performance.

The following best practices focus on architectural design and operational standards to maximize cluster stability and uptime:

Architecture and topology

• Redundant Heartbeat Design: Design the cluster with at least two heartbeat connections to prevent "split-brain" scenarios where communication is lost and both units attempt to become the Primary.

• Heartbeat Isolation: Physically isolate heartbeat traffic. Ideally, connect the heartbeat interfaces directly back-to-back. If switches are required (for clusters with more than two units), use dedicated switches or VLANs strictly for heartbeat traffic to avoid network congestion affecting cluster stability.

• Symmetrical Network Connectivity: Ensure both cluster members have identical physical connections to the internal and external networks. This guarantees that if a failover occurs, the secondary unit has the exact same network access as the failed unit.

• Full Mesh: To ensure there is no single source of failure, use a full mesh design to connect your cluster members. This involves using 2 ingress and 2 egress interfaces, preferably in an aggregate or redundant interface configuration. Connect these interfaces to redundant switches.

Hardware and licensing alignment

• Hardware Consistency: Maintain identical hardware configurations across all cluster members, including the same model, generation, RAM, and number of hard disks/SSDs. Mismatched hardware can prevent the cluster from forming or functioning correctly.

• Firmware Uniformity: Ensure all units are running the exact same firmware version and build number.

• Unified Licensing: Register all cluster members under the same FortiCare account. This prevents potential licensing conflicts and downtime, especially regarding FortiGuard services. Also maintain the same subscriptions and expiration dates

Failover logic and monitoring

• Strategic Interface Monitoring: Configure the cluster to monitor only the most critical network paths (typically the internal LAN and external WAN interfaces). A failover should only be triggered if a link essential to traffic flow goes down.

• Avoid Monitoring Heartbeats: Do not configure the cluster to "monitor" the heartbeat interfaces themselves, as their status is handled separately by the HA protocol.

• Consistent Override Policy: Standardize the "Override" setting across all members. It should be either uniformly enabled (to prioritize a specific device) or disabled (to prioritize uptime) on all units to ensure predictable primary unit selection.

• Heartbeat optimization: Fine tune your heartbeat frequencies and intervals to failover within the timeframe that is within your expectations. If sub-second failover is required, change the heartbeat interval metric from 100ms to 10ms

Performance optimization

• Session Synchronization Efficiency: Use the session-pickup-delay feature to filter out short-lived sessions (like DNS or quick HTTP lookups) from being synchronized. This reduces CPU and bandwidth overhead on the heartbeat links.

• Dedicated Session Sync Interface: For high-traffic environments, offload session synchronization traffic from the heartbeat interface to a dedicated data interface (using session-sync-dev). This prevents heartbeat congestion during traffic spikes.

• Heartbeat Bandwidth Management: Avoid using heartbeat interfaces for regular traffic processing. Keeping these interfaces dedicated prevents user traffic from congesting the link and causing false failovers.

Management and operations

• Out-of-Band Management: Utilize reserved management interfaces for cluster administration. This assigns a unique IP to each member, allowing for direct monitoring (via SNMP) and management of the secondary unit without affecting the primary's operation.

• Synchronized Upgrades: Plan for "Uninterrupted Upgrades" where the cluster manages the firmware update sequence (Secondary -> Primary) to minimize traffic disruption during maintenance windows.

Security

• Heartbeat Encryption: Enable authentication and encryption for heartbeat packets, especially if the heartbeat links pass through shared switches. This prevents unauthorized devices from joining the cluster or spoofing heartbeat signals.